Notice of Privacy Practices
Last updated: August 14, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Who this Notice applies to
This Notice of Privacy Practices (the "Notice") explains how medical information about you may be used and disclosed in connection with healthcare services you request or receive through the Oat Meds platform, and describes related rights you may have. It is intended as a transparency notice and should not be read as a representation that Oat Meds LLC is a HIPAA covered entity.
Clinical care through the platform is provided by independent licensed healthcare professionals associated with Beluga Health, P.A. ("Beluga") and Beluga's providers (each a "Provider"). Providers are licensed or otherwise authorized to provide care in the jurisdiction where they treat a patient. Not every Provider is available in every jurisdiction. Medications, when prescribed, are dispensed by licensed pharmacies, which may include partner 503A or 503B compounding pharmacies.
Oat Meds LLC ("Oat Meds") operates the technology platform that helps you connect with Beluga, Providers, and pharmacies. Oat Meds is not itself a provider group or a pharmacy. Oat Meds may receive and use medical information as needed to operate the platform and support administrative, payment, scheduling, messaging, and fulfillment coordination activities on behalf of or in coordination with Beluga, Providers, and pharmacies. Oat Meds does not itself provide medical care, make clinical decisions, or prescribe medications. Oat Meds and Beluga have advised that neither currently operates as a HIPAA covered entity. This Notice therefore does not state or imply that Oat Meds is a HIPAA covered entity or that HIPAA applies to all information handled through the Services. Other federal and state medical privacy, consumer health data, confidentiality, security, and record-retention laws may apply.
Beluga and Pharmacy Network partners may also provide their own privacy notices. Please review any Beluga privacy materials presented during intake, in addition to this Notice and our Privacy Policy.
In this Notice, "we," "us," and "our" refer to Oat Meds together with Beluga and Providers to the extent they use or disclose medical information in connection with Services obtained through the platform, unless the context indicates otherwise.
How we may use and disclose medical information
Medical information about you may be used and disclosed by Providers, Beluga staff, Oat Meds (in its platform-support role), pharmacies, and other parties involved in your care for purposes of providing healthcare services, supporting related operations, obtaining payment, and other purposes allowed or required by applicable law.
Treatment
We may use and disclose medical information to provide, coordinate, or manage your healthcare and related services. This includes sharing information with Providers, pharmacies, laboratories, or other clinicians involved in your care. For example, information may be shared with a pharmacy so a prescription can be filled, or with another clinician if a referral is appropriate.
Payment
We may use and disclose medical information to bill or collect payment for healthcare services and related products, including processing charges through the Oat Meds platform, coordinating with payment processors, and addressing billing questions. If insurance is involved for a particular offering, information may also be used for eligibility, coverage, or medical-necessity review where applicable.
Healthcare operations
We may use or disclose medical information as needed to support healthcare and platform operations. Examples include quality improvement, customer support related to your care or orders, maintaining and securing systems, legal and compliance activities, audits, fraud prevention, credentialing support, and evaluating treatment alternatives or health-related services that may be relevant to you.
Communications
We may contact you by account message, email, phone, or text (where you have provided appropriate contact information and consents) about your care, prescriptions, shipping, appointments, follow-up, and related support. Service-related messages may include details about your treatment. Marketing communications are handled as described in our Privacy Policy and only as permitted by law and your choices.
Vendors and partners
Some services are performed by contractors, including AWS and DigitalOcean for infrastructure and hosting, Freshdesk for customer support, Postmark for email delivery, Vonage for SMS, Stripe for payment processing, and Pharmacy Network partners for fulfillment. Medical information may be disclosed to those parties as needed for them to perform their work, subject to contractual and legal safeguards appropriate to the relationship.
Uses and disclosures that typically do not require authorization
Subject to applicable law, medical information may be used or disclosed without your prior authorization in situations such as:
- As required by law
- For public health activities
- For healthcare oversight activities
- For reports of abuse, neglect, or domestic violence where required or permitted
- In connection with certain FDA-related activities
- In legal proceedings and for law enforcement purposes, as permitted
- To coroners, medical examiners, funeral directors, or organ procurement organizations, as applicable
- For certain research purposes under applicable requirements
- For workers' compensation or similar programs
- To avert a serious threat to health or safety
- For certain military, national security, or correctional institutional purposes, where applicable
State laws may provide additional protections or limitations. Where applicable state law provides greater privacy, confidentiality, access, amendment, deletion, consent, or medical-record protections, those requirements control.
Uses and disclosures that require your authorization
Other uses and disclosures not described in this Notice will generally be made only with your written authorization (or as otherwise permitted or required by law). Without your authorization, we will not sell your medical information, and we will not use or disclose it for marketing in ways that require authorization under applicable law. If you give an authorization, you may revoke it in writing at any time, except to the extent we have already relied on it.
Your rights regarding medical information
Subject to applicable law and any limitations that apply to a particular record set, you may have the right to:
- Inspect and obtain a copy of medical information about you that we maintain
- Request an amendment if you believe information is incorrect or incomplete
- Request restrictions on certain uses or disclosures (we are not always required to agree, except where applicable law requires us to honor a restriction---for example, in some cases involving services paid in full out of pocket)
- Request confidential communications by alternative means or at an alternative location, when reasonable
- Request an accounting of certain disclosures of medical information, subject to legal exceptions (for example, many disclosures for treatment, payment, or healthcare operations)
- Obtain a copy of this Notice, including a paper copy upon request
To exercise these rights, contact privacy@oatmeds.com. We may ask you to submit the request in writing and may need to verify your identity. Fees permitted by law may apply to copies in some cases. If we deny a request, we will generally provide a written explanation and information about any review rights that apply.
Safeguards
We use administrative, technical, and physical safeguards---including encrypted communications where appropriate, access controls, authentication measures, monitoring, and other security practices---designed to protect medical information against unauthorized access, use, or disclosure. Information submitted through the Services is transmitted using encrypted connections (such as TLS/SSL) where supported. No method of transmission or storage is completely secure, and you transmit information at your own risk.
You are responsible for securing devices you use to access the Services (for example, device passcodes and account password hygiene).
Breach notification
If a breach of unsecured medical information occurs that requires notification under applicable law, we will provide notice as required, generally describing what happened, the information involved (to the extent known), steps you can take, what we are doing in response, and how to contact us with questions.
Changes to this Notice
We may revise this Notice from time to time. The revised Notice will be effective for medical information we already have as well as information we receive in the future, to the extent permitted by law. The current Notice will be posted on our website with an updated date. You may request a copy of the Notice currently in effect at any time.
Complaints and contact
If you have questions about this Notice, or if you believe your privacy rights have been violated in connection with Services obtained through the platform, contact:
Oat Meds LLC
382 NE 191st St PMB 826830
Miami, FL 33179
Email: privacy@oatmeds.com
You may also raise concerns with Beluga through any channels Beluga provides in its own privacy materials. We will not retaliate against you for filing a privacy complaint in good faith.